@ours.network/fleet 0.17.7 → 0.18.0-nightly.2

package/dist/harness/codex.js

@@ -5,7 +5,7 @@ import { agentDir, home } from '../paths.js';
 import { realExec } from '../exec.js';
 import { registerAdapter } from './registry.js';
 import { harnessRuntimeDir } from '../isolation/policy.js';
-import { resolveBundledAcpAgent, } from './acp-agent.js';
+import { bundledAcpAgent, resolveBundledAcpAgent } from './acp-agent.js';
 const OPTION_KEYS = [
     'launcher', 'sandbox', 'approval', 'permission_mode', 'search', 'profile', 'config', 'add_dirs',
     'monitor',
@@ -51,7 +51,9 @@ function sandboxMode(role) {
         throw new Error(`invalid harness_options.sandbox "${s}"; allowed: ${SANDBOX_MODES.join(', ')}`);
     return s;
 }
-function modeForSandbox(sandbox) {
+/** codex-acp exposes the same sandbox postures as named ACP agent modes. */
+function acpAgentMode(role) {
+    const sandbox = sandboxMode(role);
     if (sandbox === 'read-only')
         return 'read-only';
     if (sandbox === 'workspace-write')
@@ -60,26 +62,6 @@ function modeForSandbox(sandbox) {
         return 'agent-full-access';
     return undefined;
 }
-/**
- * Resolve the coupled Codex ACP mode.
- *
- * The portable approval contract owns the default mode selection: `allow`
- * means the adapter's fully non-interactive yolo preset and `auto` means its
- * ordinary agent preset. This intentionally means that Codex ACP cannot retain
- * an independent neutral filesystem posture for those two modes. An explicit
- * native sandbox remains authoritative and selects its corresponding preset.
- */
-function acpAgentMode(role) {
-    const explicitSandbox = role.harness_options?.sandbox;
-    if (explicitSandbox != null)
-        return modeForSandbox(sandboxMode(role));
-    if (role.permissions?.approval === 'allow')
-        return 'agent-full-access';
-    if (role.permissions?.approval === 'auto')
-        return 'agent';
-    const sandbox = sandboxMode(role);
-    return modeForSandbox(sandbox);
-}
 function acpModePermissions(mode) {
     if (mode === 'read-only')
         return { approval: 'on-request', sandbox: 'read-only' };
@@ -87,10 +69,6 @@ function acpModePermissions(mode) {
         return { approval: 'never', sandbox: 'danger-full-access' };
     return { approval: 'on-request', sandbox: 'workspace-write' };
 }
-/** The sandbox Codex will actually receive from the selected coupled ACP mode. */
-function acpRuntimeSandbox(role) {
-    return acpModePermissions(acpAgentMode(role)).sandbox;
-}
 function fleetModeForApproval(nativeMode) {
     if (nativeMode === 'never')
         return 'allow';
@@ -124,18 +102,6 @@ function launcherMode(role) {
 function bundledCodexAcp() {
     return resolveBundledAcpAgent(CODEX_ACP_PACKAGE, 'codex-acp', 'codex-acp');
 }
-/** Bind launch argv and metadata provenance to one already-completed resolution. */
-export function codexAcpLaunchForResolution(resolution) {
-    const permissionMetadataSource = resolution.bundled
-        && resolution.version === BUNDLED_CODEX_ACP_VERSION
-        && resolution.manifestPath !== undefined
-        ? 'codex-acp'
-        : undefined;
-    return {
-        argv: [...resolution.argv],
-        ...(permissionMetadataSource ? { permissionMetadataSource } : {}),
-    };
-}
 function canOverrideBundledAcpApproval() {
     const resolution = bundledCodexAcp();
     return resolution.bundled && resolution.version === BUNDLED_CODEX_ACP_VERSION
@@ -181,7 +147,7 @@ function codexAcpEnvironment(role, dirs) {
     return {
         CODEX_PATH: command,
         [CODEX_PROXY_APPROVAL_ENV]: approvalPolicy(role) ?? 'on-request',
-        [CODEX_PROXY_SANDBOX_ENV]: acpRuntimeSandbox(role),
+        [CODEX_PROXY_SANDBOX_ENV]: sandboxMode(role) ?? 'workspace-write',
         [CODEX_PROXY_MANIFEST_ENV]: resolution.manifestPath,
         ...(process.env.CODEX_PATH ? { [CODEX_PROXY_REAL_PATH_ENV]: process.env.CODEX_PATH } : {}),
     };
@@ -333,30 +299,17 @@ export function makeCodexAdapter(exec = realExec) {
         },
         buildAcpLaunch(role, prep) {
             const configured = role.session_options?.acp?.command;
-            // Resolve once: both argv and permission-metadata provenance must describe
-            // the same artifact. A bare PATH fallback is launchable for compatibility,
-            // but is never authenticated for protected-MCP auto-approval.
-            const resolved = configured == null
-                ? codexAcpLaunchForResolution(bundledCodexAcp())
-                : undefined;
             const argv = Array.isArray(configured)
                 ? [...configured]
                 : typeof configured === 'string'
                     ? ['sh', '-c', configured]
-                    : resolved.argv;
+                    : bundledAcpAgent(CODEX_ACP_PACKAGE, 'codex-acp', 'codex-acp');
             const initialMode = acpAgentMode(role);
             return {
                 argv,
                 env: initialMode ? { ...prep.env, INITIAL_AGENT_MODE: initialMode } : prep.env,
-                ...(resolved?.permissionMetadataSource
-                    ? { permissionMetadataSource: resolved.permissionMetadataSource } : {}),
             };
         },
-        // INITIAL_AGENT_MODE covers session/new in codex-acp; session/set_mode
-        // keeps resumed/loaded sessions and live status on the identical mode.
-        acpPermissionModeId(role) {
-            return acpAgentMode(role);
-        },
         isolationPaths(role, _dirs) {
             const codexHome = join(home(), '.codex');
             const profile = role.harness_options?.profile;
@@ -409,9 +362,7 @@ export function makeCodexAdapter(exec = realExec) {
                 const mode = acpAgentMode(role) ?? 'agent';
                 const configured = role.session_options?.acp?.command;
                 const overrideAvailable = configured == null && canOverrideBundledAcpApproval();
-                const actual = overrideAvailable
-                    ? { approval, sandbox: acpRuntimeSandbox(role) }
-                    : acpModePermissions(mode);
+                const actual = overrideAvailable ? { approval, sandbox } : acpModePermissions(mode);
                 const exact = actual.approval === approval && actual.sandbox === sandbox;
                 return {
                     ...translated,
@@ -421,9 +372,10 @@ export function makeCodexAdapter(exec = realExec) {
                             ? `custom ACP command cannot be verified against approval=${approval} sandbox=${sandbox}; `
                                 + `its '${mode}' mode is conservatively treated as approval=${actual.approval} `
                                 + `sandbox=${actual.sandbox}`
-                            : `Codex ACP mode '${mode}' couples approval and filesystem as `
-                                + `approval=${actual.approval} sandbox=${actual.sandbox}; this does not exactly `
-                                + `represent approval=${approval} sandbox=${sandbox}`],
+                            : `codex-acp mode '${mode}' actually uses approval=${actual.approval} `
+                                + `sandbox=${actual.sandbox}, and the bundled ${BUNDLED_CODEX_ACP_VERSION} `
+                                + `app-server override is unavailable; this does not exactly represent `
+                                + `approval=${approval} sandbox=${sandbox}`],
                     capabilities: codexCapabilities(actual.approval, actual.sandbox),
                 };
             }

package/dist/harness/types.d.ts

@@ -26,9 +26,9 @@ export interface Launch {
     argv: string[];
     env: Record<string, string>;
 }
-export interface AcpLaunch extends Launch {
-    /** Metadata vocabulary authenticated by the exact ACP artifact in argv. */
-    permissionMetadataSource?: 'codex-acp';
+export interface AcpLaunch {
+    argv: string[];
+    env: Record<string, string>;
 }
 /**
  * The result of expressing neutral `permissions:` in a harness's own terms.

package/dist/loops/manager.d.ts

@@ -68,32 +68,8 @@ export declare class ScheduledLoopManager implements ScheduledLoopManagerHandle
     private armAbandon;
     private finish;
     private advance;
-    /**
-     * Coalesce a backlog into one skip. The counters alone say how many
-     * occurrences were lost but never when or for how long, so the window is
-     * recorded too and carried on the state until a run is actually told about it
-     * — a dropped pass has to stay visible to the next one, not just to whoever
-     * was reading the log at the time.
-     */
     private skipMissed;
-    /**
-     * Restart is not, by itself, a reason to lose an occurrence a running manager
-     * would still have run. `poll` tolerates lateness up to one full interval and
-     * runs the tick late; this path used to drop anything already due however
-     * recently, so a role restarted seconds after its own tick came due lost it
-     * outright. For an oversight role that is precisely the pass which would have
-     * recorded why it restarted, so the failure erased its own witness.
-     *
-     * The tolerance is the only thing shared with `poll`. A backlog at least one
-     * interval deep is still coalesced into a single skip and never replayed —
-     * after a long outage exactly one occurrence survives, and `schedule` then
-     * arms it through the ordinary path rather than firing a burst here.
-     *
-     * Running the survivor late cannot outpace the configured cadence: `advance`
-     * moves the cursor by exactly one `intervalMs` per occurrence from the nominal
-     * time, so a loop that keeps restarting still runs at most once per interval.
-     */
-    private skipRestartBacklog;
+    private skipRestartMisses;
     /**
      * A run the store could not record is dropped, not retried: the cursor has
      * already moved, so this can never become a busy loop, and the outage is
@@ -110,10 +86,5 @@ export declare class ScheduledLoopManager implements ScheduledLoopManagerHandle
      * until the process was restarted.
      */
     private recover;
-    /**
-     * The envelope is the only channel a scheduled pass has for learning about
-     * the passes that did not happen. A gap stated here is what lets an oversight
-     * role report its own outage instead of resuming as if nothing was missed.
-     */
     private envelope;
 }

package/dist/loops/manager.js

@@ -39,7 +39,7 @@ export class ScheduledLoopManager {
     }
     start() {
         if (!this.store.fresh)
-            this.skipRestartBacklog();
+            this.skipRestartMisses();
         this.schedule();
     }
     async stop() {
@@ -143,15 +143,10 @@ export class ScheduledLoopManager {
     async attempt(definition, state, scheduledAt) {
         const runId = `sl_${randomUUID()}`;
         const origin = { kind: 'scheduled-loop', loop: definition.name, runId };
-        // The gap is read here and cleared only if the turn is actually admitted:
-        // an attempt that ends `skipped_busy` or `unavailable` reported it to
-        // nobody, so it has to still be there for the attempt that succeeds.
-        const gap = state.missedGap;
-        const prompt = this.envelope(definition, runId, scheduledAt, gap);
+        const prompt = this.envelope(definition, runId, scheduledAt);
         let claimed = false;
         const result = await this.arbiter.tryScheduled(prompt, origin, () => {
             claimed = true;
-            state.missedGap = null;
             state.activeRunId = runId;
             state.lastRunId = runId;
             state.lastStartedAt = new Date(this.deps.now()).toISOString();
@@ -270,15 +265,7 @@ export class ScheduledLoopManager {
         state.nextScheduledAt = new Date(next).toISOString();
         state.nextDueAt = new Date(next + deterministicJitter(this.role, definition.name, next, definition.jitterMs)).toISOString();
     }
-    /**
-     * Coalesce a backlog into one skip. The counters alone say how many
-     * occurrences were lost but never when or for how long, so the window is
-     * recorded too and carried on the state until a run is actually told about it
-     * — a dropped pass has to stay visible to the next one, not just to whoever
-     * was reading the log at the time.
-     */
     skipMissed(definition, state, now) {
-        const from = state.nextScheduledAt;
         let missed = 0;
         while (Date.parse(state.nextDueAt) <= now) {
             this.advance(definition, state);
@@ -288,43 +275,14 @@ export class ScheduledLoopManager {
         state.counts.skippedMissed = increment(state.counts.skippedMissed, missed);
         state.lastOutcome = 'skipped_missed';
         state.lastFinishedAt = new Date(now).toISOString();
-        // Successive outages before any run lands merge into one gap: the earliest
-        // start wins, so the window always spans the whole silence.
-        const previous = state.missedGap;
-        state.missedGap = {
-            count: increment(previous?.count ?? 0, missed),
-            fromAt: previous?.fromAt ?? from,
-            throughAt: state.lastScheduledAt ?? from,
-            detectedAt: new Date(now).toISOString(),
-        };
         this.store.persist();
-        this.deps.log(`[${this.role}] loop ${definition.name} skipped_missed count=${missed} `
-            + `gap=${from}..${state.missedGap.throughAt} `
-            + `unreported=${state.missedGap.count}`);
+        this.deps.log(`[${this.role}] loop ${definition.name} skipped_missed count=${missed}`);
     }
-    /**
-     * Restart is not, by itself, a reason to lose an occurrence a running manager
-     * would still have run. `poll` tolerates lateness up to one full interval and
-     * runs the tick late; this path used to drop anything already due however
-     * recently, so a role restarted seconds after its own tick came due lost it
-     * outright. For an oversight role that is precisely the pass which would have
-     * recorded why it restarted, so the failure erased its own witness.
-     *
-     * The tolerance is the only thing shared with `poll`. A backlog at least one
-     * interval deep is still coalesced into a single skip and never replayed —
-     * after a long outage exactly one occurrence survives, and `schedule` then
-     * arms it through the ordinary path rather than firing a burst here.
-     *
-     * Running the survivor late cannot outpace the configured cadence: `advance`
-     * moves the cursor by exactly one `intervalMs` per occurrence from the nominal
-     * time, so a loop that keeps restarting still runs at most once per interval.
-     */
-    skipRestartBacklog() {
+    skipRestartMisses() {
         const now = this.deps.now();
         for (const definition of this.definitions.values()) {
             const state = this.store.state.loops[definition.name];
-            if (definition.enabled && !state.operatorDisabled
-                && now >= Date.parse(state.nextDueAt) + definition.intervalMs)
+            if (definition.enabled && !state.operatorDisabled && Date.parse(state.nextDueAt) <= now)
                 this.skipMissed(definition, state, now);
         }
     }
@@ -382,34 +340,17 @@ export class ScheduledLoopManager {
             this.deps.clearTimer(this.timer);
         this.arm(backoffMs(this.pollFailures));
     }
-    /**
-     * The envelope is the only channel a scheduled pass has for learning about
-     * the passes that did not happen. A gap stated here is what lets an oversight
-     * role report its own outage instead of resuming as if nothing was missed.
-     */
-    envelope(definition, runId, scheduledAt, gap) {
-        const lateBy = Math.max(0, this.deps.now() - scheduledAt);
+    envelope(definition, runId, scheduledAt) {
         return [
             '[fleet-loop]',
             `loop: ${definition.name}`,
             `run: ${runId}`,
             `scheduled_at: ${new Date(scheduledAt).toISOString()}`,
-            ...(lateBy > 0 ? [`started_late_by_ms: ${lateBy}`] : []),
-            ...(gap ? [
-                `missed_occurrences: ${gap.count}`,
-                `missed_window: ${gap.fromAt}..${gap.throughAt}`,
-                `missed_gap_ms: ${Math.max(0, Date.parse(gap.detectedAt) - Date.parse(gap.fromAt))}`,
-            ] : []),
             'origin: local-trusted-config',
             '',
             'This is a scheduled internal maintenance turn, not an owner message and not ordinary ours mail.',
             'Perform one bounded pass. Do not wait for the next tick. Do not report to an owner unless your',
             'configured policy and an existing authenticated proactive-report route authorize a material report.',
-            ...(gap ? ['',
-                'This loop did not run for the window above: those occurrences were coalesced away while the role',
-                'was unavailable, and this pass is the first since. Treat the gap as part of what you are reporting',
-                'on — it is the record of your own outage, and no later pass will be told about it.',
-            ] : []),
             '',
             definition.prompt,
         ].join('\n');

package/dist/loops/state.d.ts

@@ -8,29 +8,11 @@ export interface LoopCounts {
     skippedBusy: number;
     skippedMissed: number;
 }
-/**
- * A coalesced run of occurrences that were never submitted, held until a run
- * actually starts and can be told about it. Without it a dropped occurrence
- * survives only as a counter, which says how many were lost but never when or
- * for how long — and an oversight role cannot report an outage it cannot date.
- */
-export interface LoopMissedGap {
-    /** Occurrences coalesced away, summed across every skip since the last run. */
-    count: number;
-    /** Nominal time of the earliest occurrence in the gap. */
-    fromAt: string;
-    /** Nominal time of the latest occurrence in the gap. */
-    throughAt: string;
-    /** When the manager noticed — the end of the outage, not of the last skip. */
-    detectedAt: string;
-}
 export interface LoopRuntimeState {
     definitionHash: string;
     promptHash: string;
     enabled: boolean;
     operatorDisabled: boolean;
-    /** Unreported gap, cleared by the first run that carries it. */
-    missedGap: LoopMissedGap | null;
     nextScheduledAt: string;
     nextDueAt: string;
     lastScheduledAt: string | null;

package/dist/loops/state.js

@@ -100,9 +100,6 @@ export class ScheduledLoopStateStore {
             if (old?.definitionHash === definition.definitionHash) {
                 next[definition.name] = {
                     ...old, promptHash: definition.promptHash, enabled: definition.enabled,
-                    // A file written before this field existed restores as undefined; an
-                    // unreported gap is absent, not lost, so normalize rather than trust.
-                    missedGap: old.missedGap ?? null,
                 };
             }
             else {
@@ -122,7 +119,6 @@ export class ScheduledLoopStateStore {
                     activeRunId: old?.activeRunId ?? null,
                     counts: old?.counts ?? zeroCounts(), lastError: old?.lastError ?? null,
                     operatorDisabled: old?.operatorDisabled ?? false,
-                    missedGap: old?.missedGap ?? null,
                 };
             }
             if (recoverActive && next[definition.name].activeRunId) {

package/dist/owner-channel/attachments.d.ts

@@ -1,4 +1,6 @@
+import { type FileHandle } from 'node:fs/promises';
 import type { OwnerAttachmentConfig } from '../config.js';
+import type { OursIncomingFile, OursRetrievedFiles } from './ours-client.js';
 export interface AttachmentReplyRef {
     wire_id: string;
     sentence?: number;
@@ -42,8 +44,14 @@ export interface AdmittedAttachment {
     kind: 'file' | 'voice_message';
     transcription?: Omit<VoiceTranscription, 'audioPath'>;
 }
-export declare function parseIncomingAttachments(raw: unknown): IncomingAttachment[];
-export declare function parseRetrievedAttachments(raw: unknown, expected: IncomingAttachment[], recovered?: boolean): RetrievedAttachment[];
+/**
+ * Admit the daemon's file listing. The rows are typed now, but every field is
+ * still re-validated here: sender CID, wire id, sizes and ids all cross the
+ * trust boundary and decide routing, so a daemon-side shape change must drop a
+ * row rather than produce a half-built attachment.
+ */
+export declare function parseIncomingAttachments(raw: OursIncomingFile[] | undefined): IncomingAttachment[];
+export declare function parseRetrievedAttachments(raw: OursRetrievedFiles | undefined, expected: IncomingAttachment[], recovered?: boolean): RetrievedAttachment[];
 export declare function validateAttachmentSelection(files: IncomingAttachment[], config: OwnerAttachmentConfig): string | undefined;
 /**
  * Managed-agent -> owner egress limits. This intentionally does not consult
@@ -54,6 +62,21 @@ export declare function prepareAttachmentDirectory(root: string, requestId: stri
 export declare function admitAttachments(files: RetrievedAttachment[], dir: string, config: OwnerAttachmentConfig, options?: {
     mimePolicy?: 'strict' | 'report-only';
 }): Promise<AdmittedAttachment[]>;
+/** Injectable short-write seam, so partial writes are provably handled. */
+export interface AttachmentWriteDeps {
+    write?(handle: FileHandle, bytes: Uint8Array, offset: number): Promise<number>;
+}
+/**
+ * Land crash-recovered file bytes inside an already-prepared request directory.
+ *
+ * The MCP path handed the daemon a `dest_path` and let its connector write the
+ * file. Nothing writes on our behalf any more, so this owns both halves of that
+ * contract: the destination is DERIVED from a validated wire id inside `dir`
+ * rather than accepted from a caller, and the file is published by link-after-
+ * fsync, so a crash or a short write can never leave a partial file where the
+ * admission step would read it as complete.
+ */
+export declare function writeRecoveredAttachment(dir: string, wireId: string, bytes: Uint8Array, deps?: AttachmentWriteDeps): Promise<string>;
 export declare function recoveredAttachment(file: IncomingAttachment, path: string): Promise<RetrievedAttachment>;
 export declare function removeRequestDirectory(path: string): Promise<void>;
 export declare function cleanupAttachmentRoot(root: string, now: number, retentionMs: number, limit?: number): Promise<number>;

package/dist/owner-channel/attachments.js

@@ -6,8 +6,14 @@ import { replaceFileAtomically } from '../atomic-file.js';
 const WIRE = /^[A-Fa-f0-9]{64}$/;
 const CID = /^[A-Fa-f0-9]{64}$/;
 const MAX_PENDING_REQUESTS = 32;
+/**
+ * Admit the daemon's file listing. The rows are typed now, but every field is
+ * still re-validated here: sender CID, wire id, sizes and ids all cross the
+ * trust boundary and decide routing, so a daemon-side shape change must drop a
+ * row rather than produce a half-built attachment.
+ */
 export function parseIncomingAttachments(raw) {
-    const values = raw?.files;
+    const values = raw;
     if (!Array.isArray(values))
         return [];
     const out = [];
@@ -40,12 +46,12 @@ export function parseIncomingAttachments(raw) {
 export function parseRetrievedAttachments(raw, expected, recovered = false) {
     const values = raw?.files;
     if (!Array.isArray(values) || values.length !== expected.length)
-        throw new Error('ours-mcp returned an incomplete selected attachment set');
+        throw new Error('the ours daemon returned an incomplete selected attachment set');
     const byWire = new Map(expected.map(file => [file.wireId, file]));
     const out = [];
     for (const value of values) {
         if (!value || typeof value !== 'object')
-            throw new Error('ours-mcp returned invalid attachment metadata');
+            throw new Error('the ours daemon returned invalid attachment metadata');
         const file = value;
         const wireId = String(file.wire_id ?? '');
         const listed = byWire.get(wireId);
@@ -58,7 +64,7 @@ export function parseRetrievedAttachments(raw, expected, recovered = false) {
             || !Number.isSafeInteger(size) || size !== listed.size || mime !== listed.mime
             || kind !== listed.kind || !/^[a-f0-9]{64}$/.test(sha256)
             || typeof file.path !== 'string' || !file.path)
-            throw new Error('ours-mcp selected attachment provenance or integrity metadata mismatched');
+            throw new Error('selected attachment provenance or integrity metadata mismatched');
         out.push({
             ...listed, filename: safeField(file.filename, 255), mime, size, path: file.path, sha256, kind,
             ...(recovered ? {} : parseTranscription(file.transcription, wireId)),
@@ -66,7 +72,7 @@ export function parseRetrievedAttachments(raw, expected, recovered = false) {
         byWire.delete(wireId);
     }
     if (byWire.size)
-        throw new Error('ours-mcp omitted a selected attachment');
+        throw new Error('the ours daemon omitted a selected attachment');
     return out;
 }
 function parseTranscription(value, wireId) {
@@ -219,6 +225,56 @@ export async function admitAttachments(files, dir, config, options = {}) {
     }
     return admitted;
 }
+/**
+ * Land crash-recovered file bytes inside an already-prepared request directory.
+ *
+ * The MCP path handed the daemon a `dest_path` and let its connector write the
+ * file. Nothing writes on our behalf any more, so this owns both halves of that
+ * contract: the destination is DERIVED from a validated wire id inside `dir`
+ * rather than accepted from a caller, and the file is published by link-after-
+ * fsync, so a crash or a short write can never leave a partial file where the
+ * admission step would read it as complete.
+ */
+export async function writeRecoveredAttachment(dir, wireId, bytes, deps = {}) {
+    if (!WIRE.test(wireId))
+        throw new Error('recovered attachment wire id is not a 64-hex value');
+    const dirStat = await lstat(dir);
+    if (!dirStat.isDirectory() || dirStat.isSymbolicLink())
+        throw new Error('recovered attachment directory is not a safe directory');
+    const write = deps.write
+        ?? ((handle, buffer, offset) => handle.write(buffer, offset, buffer.length - offset)
+            .then(result => result.bytesWritten));
+    const finalPath = join(dir, `.recovered-${wireId}-${randomUUID()}`);
+    const tmp = join(dir, `.${basename(finalPath)}.${randomUUID()}.tmp`);
+    const handle = await open(tmp, 'wx', 0o600);
+    try {
+        for (let written = 0; written < bytes.length;) {
+            const advanced = await write(handle, bytes, written);
+            if (advanced <= 0)
+                throw new Error(`recovered attachment write made no progress at byte ${written}`);
+            written += advanced;
+        }
+        await handle.sync();
+    }
+    catch (error) {
+        await handle.close().catch(() => undefined);
+        await rm(tmp, { force: true });
+        throw error;
+    }
+    await handle.close();
+    // link publishes the finished bytes under a name that never existed in a
+    // partial state; the temp is only ever removed after it succeeded.
+    try {
+        await link(tmp, finalPath);
+    }
+    catch (error) {
+        await rm(tmp, { force: true });
+        throw error;
+    }
+    await rm(tmp, { force: true });
+    await chmod(finalPath, 0o600);
+    return finalPath;
+}
 export async function recoveredAttachment(file, path) {
     const stat = await lstat(path);
     if (!stat.isFile() || stat.isSymbolicLink() || stat.size !== file.size)

package/dist/owner-channel/channel.d.ts

@@ -4,7 +4,7 @@ import { type FetchLike } from '../monitor.js';
 import { type SessionHandle } from '../session/types.js';
 import { type OwnerFleetOps } from './commands.js';
 import type { ManagedFleetSpawnResult } from '../fleet-proxy.js';
-import { type OursToolClient } from './mcp.js';
+import { type OursOps } from './ours-client.js';
 import { type OwnerUpdatePhase } from './notices.js';
 import { type OwnerEntry } from './state.js';
 import { type OwnerTaskPhase } from './tasks.js';
@@ -17,9 +17,13 @@ export interface OwnerChannelOptions {
     session: SessionHandle;
     stateDir: string;
     env?: Record<string, string>;
+    /**
+     * `ours-mcp` binary for the legacy `watch` child process only. Daemon
+     * operations no longer go through it; they use the ours SDK client.
+     */
     command?: string;
     log(line: string): void;
-    client?: OursToolClient;
+    client?: OursOps;
     /** Legacy child-process test seam; production uses the direct notification API. */
     watch?: (identity: string) => ChildProcessWithoutNullStreams;
     /** Test seam for the production direct notification long-poll. */
@@ -118,7 +122,13 @@ export type { OwnerUpdatePhase } from './notices.js';
 export interface OwnerContact {
     cid: string;
     name: string;
+    /** Structural, from which daemon collection the row came: established or pending. */
     status: string;
+    /**
+     * Retained for the `ours-fleet owner contact list` column. The daemon's typed
+     * contact view has no such field, so it is always absent; it is not inferred
+     * from anything a contact controls.
+     */
     kind?: string;
     human?: {
         cid?: string;
@@ -174,6 +184,12 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     manage(request: OwnerChannelManagementRequest): Promise<OwnerChannelManagementResult>;
     notifyFleetSpawn(event: ManagedFleetSpawnResult): Promise<void>;
     private manageNow;
+    /**
+     * The daemon reports established contacts and pending introductions as two
+     * separate collections, so the status is structural rather than a word parsed
+     * out of a rendered line. Nothing here can be spoofed by a contact's own
+     * display name.
+     */
     private contacts;
     private contact;
     private assertCid;